Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective

TL;DR

This paper introduces Snowball, a novel federated learning framework that uses bidirectional elections from individual models to effectively exclude infected models, enhancing resistance to backdoor attacks while maintaining model accuracy.

Contribution

Snowball is the first anti-backdoor federated learning framework employing bidirectional elections from individual perspectives, improving attack resistance without significant accuracy loss.

Findings

Snowball outperforms state-of-the-art defenses on five real-world datasets.

It achieves superior resistance to backdoor attacks.

It maintains high model accuracy despite defenses.

Abstract

Existing approaches defend against backdoor attacks in federated learning (FL) mainly through a) mitigating the impact of infected models, or b) excluding infected models. The former negatively impacts model accuracy, while the latter usually relies on globally clear boundaries between benign and infected model updates. However, model updates are easy to be mixed and scattered throughout in reality due to the diverse distributions of local data. This work focuses on excluding infected models in FL. Unlike previous perspectives from a global view, we propose Snowball, a novel anti-backdoor FL framework through bidirectional elections from an individual perspective inspired by one principle deduced by us and two principles in FL and deep learning. It is characterized by a) bottom-up election, where each candidate model update votes to several peer ones such that a few model updates are elected as selectees for aggregation; and b) top-down election, where selectees progressively enlarge themselves through picking up from the candidates. We compare Snowball with state-of-the-art defenses to backdoor attacks in FL on five real-world datasets, demonstrating its superior resistance to backdoor attacks and slight impact on the accuracy of the global model.